Provenance & license

Provenance & license

Aarmos is an open spec, portable verifier, and closed product. You can independently verify every receipt without depending on Aarmatix infrastructure.

This application

Copyright © 2026 Aarmatix LLC. All rights reserved. The Aarmos web application, runtime, policy engine, command line, adapters, and enterprise consoles are proprietary. Open components carry their own licenses (see below); everything else is covered by the Aarmatix commercial terms in the Terms of Service.

Open primitives

Specification text is published under CC BY 4.0; the reference code that reads and verifies it is published under Apache-2.0.

  • avar-spec — receipt & policy wire format (CC BY 4.0)
  • aarmos-invite-spec — invite envelope format (CC BY 4.0)
  • aarmos-bundle-spec — bundle format (CC BY 4.0)
  • @avar-standard/verify — reference receipt verifier (Apache-2.0)
  • @avar-standard/core — receipt parsing & canonicalization (Apache-2.0)
  • @aarmos/starter-policies — signed starter policy bundles (Apache-2.0; not currently on public npm — see the distribution note below)
  • homebrew-tap — installer for the avar CLI (Apache-2.0)

Distribution note: the @avar-standard/* packages above are publicly installable today. @aarmos/* packages are not on the public npm registry right now — design partners receive them directly, and public distribution resumes at 1.0.0. Licensing is unchanged by availability.

Proprietary distributions

The @aarmos/cli and @aarmos/bridge packages embed the Aarmos governance runtime — the decision semantics, policy evaluation, admission, delegation and evidence implementation. Those artifacts are proprietary and ship under LicenseRef-Aarmos-Proprietary. Earlier releases carried an Apache-2.0 notice that did not describe what the artifact contained; that notice is superseded from 1.0.0 onward, and those earlier versions have been unpublished or deprecated.

This changes nothing about the open primitives listed above. The AVAR specification, the reference verifier and the @avar-standard/* packages remain open under their own licenses, and a receipt written by Aarmos stays verifiable with them whether or not you run anything of ours.

Verify a receipt yourself

brew install aarmatix/tap/avar
avar verify ./receipt.json

No Aarmatix service is contacted. Prefer not to install anything? The in-browser verifier runs the same checks on-device, and /docs carries the full verifier reference.

Build provenance

Published builds of the open verifier (Aarmatix/avar releases) ship with Sigstore keyless signatures and SLSA provenance, so auditors can pin the exact commit that produced any downloaded artifact. See /docs/verify-binary for the verification steps.

Receipt build-provenance sidecar

A receipt can optionally be accompanied by a detached sidecar file, <receipt>.provenance.json, that records which build of the runtime produced it. The sidecar is written next to the receipt and is never embedded in it: strip the sidecar and the receipt remains a valid AVAR receipt that verifies exactly as before.

  • It carries build identity only — package, version, and the build attestation reference. It contains no per-device, per-user, or per-machine identifier.
  • Conformance is expressed as a scheme, a version, a profile, and a reference to the build attestation — not as a boolean "certified" flag.
  • It is advisory context for a reviewer. Verification of the receipt itself never depends on it.

Third-party notices

Aarmos uses open-source components under their original licenses (MIT, Apache-2.0, ISC, BSD). Licenses are retained in the shipped artifacts under node_modules/ at build time.

Last updated: August 8, 2026.

See also: Terms · Privacy · Usage Guide · Trust

Commercial inquiries: legal@aarmatix.com